PSA / Bug: New Enhance vhosts not picked up by BitNinja WAF3

ali

Setup: Enhance + Apache 2, Ubuntu 24.04, BitNinja agent 3.16.12 / WAF3 1.0.17.

Problem: Migrated 3 accounts on. Enhance issued valid Let's Encrypt certs and Apache served them fine, but external visitors got ERR_CERT_COMMON_NAME_INVALID. WAF3 was answering on :443 with the server's fallback cert because BitNinja's ConfigParser left the 11 new vhosts out of getCerts-report.json (58 of 68) — even though its logs show it detecting and reparsing them with no errors. Reinstalling the agent didn't help.

Gotcha: It's invisible from the box. The loopback nft rule makes local curl/openssl s_client return the correct cert while every external client gets the wrong one. Test from outside.

Fix: Reboot. Cold start parses all vhosts; live inotify updates silently don't. After reboot WAF3 loaded all certs and everything served correctly.

Status: BitNinja confirmed it's a bug and are working on it internally.

ali

Work around after adding vhost:

bitninjacli --module=WAF3 --add-cert --domain=example.com \
  --certFile=/var/local/enhance/website_ssl/example.com.cert \
  --keyFile=/var/local/enhance/website_ssl/example.com.key

That wrote /var/lib/bitninja/WAF3/certMappings.json and forced a full rebuild of config.json, no proxy restart and no traffic interruption.